[SSSD] Ticket #1376 -- Add support for suppressing group members

Paul B. Henson henson at acm.org
Wed Nov 14 01:59:36 UTC 2012


On Tue, Nov 13, 2012 at 08:08:20PM -0500, Simo Sorce wrote:

> Is this part really necessary ?
> 
> If you do not fetch members from LDAP then memberuid will usually be
> empty anyway. In any case even if there is something (initgroups ?) then
> what you have there is only members that actually have logged in and
> that *is* information you may want to have so that applications that may
> (naively) use a getgrnam() call in order to check membership of a
> specific user will not fail at least for logged in users.

Without this part, getgr calls will sometimes return members, and
sometimes not, depending on the state of the local cache and what else
has been looked up, as well as how long the ignore_group_members option
has been set (if you look up a group without that option set, set it and
restart sssd, you'll get all members of the group as they're still in
the cache).

It seems a lot more consistent to simply never return any members than
to sporadically return some members sometimes. However, my main goal for
the feature is to avoid the (relatively) expensive LDAP lookup, so
functionally it doesn't really matter too much to me. You guys surely
have a better idea of how you want the software to operate than a
drive-by contributor ;), so I won't argue against dropping that piece if
that's what the concensus is among primary developers.

Thanks...



More information about the sssd-devel mailing list